just to elaborate on this a bit: most file systems use a table to specify which blocks are allocated to which files. when a file is "deleted" it's entry in the table is removed but the blocks remain untouched instead of written over with 0's/1's to save drive write time. so the data is still there, you just have to know how to find it. tools like the sleuthkit use sophisticated algorithms to carve out the unallocated space into files. if you know what you're doing you can find what you're looking for even on large drives.
these kind of methods are extremely common in child pornography cases. the bad guys think they deleted the incriminating files but really the data is still sitting there on the disk waiting for an expert to dig it up.
Slashdot Mirror
just to elaborate on this a bit: most file systems use a table to specify which blocks are allocated to which files. when a file is "deleted" it's entry in the table is removed but the blocks remain untouched instead of written over with 0's/1's to save drive write time. so the data is still there, you just have to know how to find it. tools like the sleuthkit use sophisticated algorithms to carve out the unallocated space into files. if you know what you're doing you can find what you're looking for even on large drives. these kind of methods are extremely common in child pornography cases. the bad guys think they deleted the incriminating files but really the data is still sitting there on the disk waiting for an expert to dig it up.